Neo’s Nix Dotfiles

About This Repository

These are my personal dotfiles for the machines and environments I use. I manage them declaratively with Denix, nix-darwin, and Home Manager.

The repository is intentionally tailored to my hosts, accounts, preferred tools, and desktop setup. It is not a general-purpose Nix configuration, framework, or starter template, and I do not try to preserve compatibility for other users. The source may still be useful as a reference or a starting point for a fork.

Denix discovers .nix files under hosts/, modules/, and rices/. The repository’s ownership rules and change checklist are in docs/denix-architecture.md.

Deploying the seiran-vm1 Tart VM

On a Nix-equipped VM without darwin-rebuild, bootstrap it with one switch:

sudo nix run nix-darwin/master#darwin-rebuild -- switch --flake .#seiran-vm1

Use the installed command for subsequent switches:

sudo darwin-rebuild switch --flake .#seiran-vm1

Both commands activate the nix-darwin system and its integrated Home Manager configuration.

Installing Standalone Linux Server Packages

Install the repository’s wrapped Neovim and selected command-line tools without activating Home Manager:

nix profile install .#nvim .#server-tools

The nvim package currently targets x86_64-linux and is assembled from the Cloud9 NVF profile. The server-tools bundle is available on both x86_64-linux and aarch64-linux and contains binaries only; it does not install shell configuration, aliases, or integrations.

Repository Layout

• hosts/ contains machine facts and host-only bindings.
• modules/ contains reusable program, service, shared-data, and toplevel integration modules.
• rices/ contains desktop-experience policy selected through repository-owned interfaces.
• docs/ contains stable cross-cutting policy and runbooks.
• packages/ contains repository-owned package derivations.

Validation

Use nix flake check --no-build --no-update-lock-file for fast evaluation, build a named checks.<system>.<name> output for focused validation, and run nix run .#check-full before completion. The staging rule, system-specific behavior, and check ownership map are in docs/nix-validation.md.

Notes and Runbooks

• Nix validation: docs/nix-validation.md
• Architecture and ownership: docs/denix-architecture.md
• Documentation policy: docs/documentation-policy.md
• Host performance tiers: docs/host-tiers.md
• SOPS key rotation: docs/secrets-key-rotation.md
• AquaSKK setup and recovery: modules/programs/aquaskk/README.md
• Coding-agent entry guidance: AGENTS.md

Secrets are declared by modules/toplevel/secrets.nix and consumed through config.sops.secrets.<key>.path. Plaintext credentials do not belong in the repository.

License

See LICENSE.